Skip to main content
Information Security

Return to Answer

fix some typos, switch to US notation
Source Link
D.W.
D.W.
  • 100.3k
  • 33
  • 279
  • 604

A quick calculation:

First my assumptions:

I assume the attacker has 1'000'000$$1,000,000 to spend over the course of two years. He's using standard graphics cards, and pays 10ct/kWh.

I assume that the KDF consists of 2*n SHA256 invocations, where n is the iteration count, and can be implemented with similar efficiency on graphics cards as plain SHA256. 1

A current graphics card gives around 6MHash/s/$ and around 4MHash/J. 2

Calculation

  • Electricity cost for 1 Hash: ($0.10/kWh) / (4MHash/J) = 7*10-15$ dollars
  • Hardware cost for 1 Hash: 1 / (6MHash/s/$ * 1yr) = 55*10-15$ dollars
  • Total cost for 1 Hash: 1.2 * 10-14$ dollars
  • Hashes for 1 Dollar: 8*1013
  • Hashes for 1'000'0001,000,000 Dollars: 8*1019

This corresponds to a 66 bit password, protected with plain SHA256. TrueCrypt uses PBKDF2 with 1000 iterations, which gives us a factor 2000 bonus, so we can subtract 11 bits, and we arrive at 55 bits.

Conclusion

An attacker willing to spend one million, dollars can crack TrueCrypt passwords up to 55 bits of entropy. Estimate the value of your secrets, and adjust it appropriately.

A sophisticated attacker might use custom hardware, which would make the attack even cheaper. But I don't have any numbers at hand, for how much energy custom hardware requires per hash.

A completely random password of length 15 chosen from 37 different characters has an entropy of 78 bits, and thus is safely out of range for graphics card based attacks. Note that this only applies if the password is completely random. If it has some exploitable structure, such as words or keyboard patterns, the entropy might be considerably lower.

1 PBKDF2 uses 1HMac per iterations, which in turn has 2 hash invocations

2 I base this on Bitcoin Mining hardware comparison using that one bitcoin hash consists of 2 SHA256 invocations.

A quick calculation:

First my assumptions:

I assume the attacker has 1'000'000$ to spend over the course of two years. He's using standard graphics cards, and pays 10ct/kWh.

I assume that the KDF consists of 2*n SHA256 invocations, where n is the iteration count, and can be implemented with similar efficiency on graphics cards as plain SHA256. 1

A current graphics card gives around 6MHash/s/$ and around 4MHash/J. 2

Calculation

  • Electricity cost for 1 Hash: ($0.10/kWh) / (4MHash/J) = 7*10-15$
  • Hardware cost for 1 Hash: 1 / (6MHash/s/$ * 1yr) = 5-15$
  • Total cost for 1 Hash: 1.2 * 10-14$
  • Hashes for 1 Dollar: 8*1013
  • Hashes for 1'000'000 Dollars: 8*1019

This corresponds to a 66 bit password, protected with plain SHA256. TrueCrypt uses PBKDF2 with 1000 iterations, which gives us a factor 2000 bonus, so we can subtract 11 bits, and we arrive at 55 bits.

Conclusion

An attacker willing to spend one million, can crack TrueCrypt passwords up to 55 bits of entropy. Estimate the value of your secrets, and adjust it appropriately.

A sophisticated attacker might use custom hardware, which would make the attack even cheaper. But I don't have any numbers at hand, how much energy custom hardware requires per hash.

A completely random password of length 15 chosen from 37 different characters has an entropy of 78 bits, and thus is safely out of range for graphics card based attacks. Note that this only applies if the password is completely random. If it has some exploitable structure, such as words or keyboard patterns, the entropy might be considerably lower.

1 PBKDF2 uses 1HMac per iterations, which in turn has 2 hash invocations

2 I base this on Bitcoin Mining hardware comparison using that one bitcoin hash consists of 2 SHA256 invocations.

A quick calculation:

First my assumptions:

I assume the attacker has $1,000,000 to spend over the course of two years. He's using standard graphics cards, and pays 10ct/kWh.

I assume that the KDF consists of 2*n SHA256 invocations, where n is the iteration count, and can be implemented with similar efficiency on graphics cards as plain SHA256. 1

A current graphics card gives around 6MHash/s/$ and around 4MHash/J. 2

Calculation

  • Electricity cost for 1 Hash: ($0.10/kWh) / (4MHash/J) = 7*10-15 dollars
  • Hardware cost for 1 Hash: 1 / (6MHash/s/$ * 1yr) = 5*10-15 dollars
  • Total cost for 1 Hash: 1.2 * 10-14 dollars
  • Hashes for 1 Dollar: 8*1013
  • Hashes for 1,000,000 Dollars: 8*1019

This corresponds to a 66 bit password, protected with plain SHA256. TrueCrypt uses PBKDF2 with 1000 iterations, which gives us a factor 2000 bonus, so we can subtract 11 bits, and we arrive at 55 bits.

Conclusion

An attacker willing to spend one million dollars can crack TrueCrypt passwords up to 55 bits of entropy. Estimate the value of your secrets, and adjust it appropriately.

A sophisticated attacker might use custom hardware, which would make the attack even cheaper. But I don't have any numbers at hand for how much energy custom hardware requires per hash.

A completely random password of length 15 chosen from 37 different characters has an entropy of 78 bits, and thus is safely out of range for graphics card based attacks. Note that this only applies if the password is completely random. If it has some exploitable structure, such as words or keyboard patterns, the entropy might be considerably lower.

1 PBKDF2 uses 1HMac per iterations, which in turn has 2 hash invocations

2 I base this on Bitcoin Mining hardware comparison using that one bitcoin hash consists of 2 SHA256 invocations.

deleted 2 characters in body
Source Link
CodesInChaos
CodesInChaos
  • 12.1k
  • 2
  • 42
  • 50

A quick calculation:

First my assumptions:

I assume the attacker has 1'000'000$ to spend over the course of two years. He's using standard graphics cards, and pays 10ct/kWh.

I assume that the KDF consists of 2*n SHA256 invocations, where n is the iteration count, and can be implemented with similar efficiency on graphics cards as plain SHA256. 1

A current graphics card gives around 6MHash/s/$ and around 2MHash4MHash/J. 2

Calculation

  • Electricity cost for 1 Hash: ($0.10/kWh) / (2MHash4MHash/J) = 1.4*107*10-1415$
  • Hardware cost for 1 Hash: 1 / (6MHash/s/$ * 1yr) = 5.3-15$
  • Total cost for 1 Hash: 21.2 * 10-14$
  • Hashes for 1 Dollar: 5*108*1013
  • Hashes for 1'000'000 Dollars: 5*108*1019

This corresponds to a 6566 bit password, protected with plain SHA256. TrueCrypt uses PBKDF2 with 1000 iterations, which gives us a factor 2000 bonus, so we can subtract 11 bits, and we arrive at 5455 bits.

Conclusion

An attacker willing to spend one million, can crack TrueCrypt passwords up to 5455 bits of entropy. Estimate the value of your secrets, and adjust it appropriately.

A sophisticated attacker might use custom hardware, which would make the attack even cheaper. But I don't have any numbers at hand, how much energy custom hardware requires per hash.

A completely random password of length 15 chosen from 37 different characters has an entropy of 78 bits, and thus is safely out of range for graphics card based attacks. Note that this only applies if the password is completely random. If it has some exploitable structure, such as words or keyboard patterns, the entropy might be considerably lower.

1 PBKDF2 uses 1HMac per iterations, which in turn has 2 hash invocations

2 I base this on Bitcoin Mining hardware comparison using that one bitcoin hash consists of 2 SHA256 invocations.

A quick calculation:

First my assumptions:

I assume the attacker has 1'000'000$ to spend over the course of two years. He's using standard graphics cards, and pays 10ct/kWh.

I assume that the KDF consists of 2*n SHA256 invocations, where n is the iteration count, and can be implemented with similar efficiency on graphics cards as plain SHA256. 1

A current graphics card gives around 6MHash/s/$ and around 2MHash/J. 2

Calculation

  • Electricity cost for 1 Hash: ($0.10/kWh) / (2MHash/J) = 1.4*10-14$
  • Hardware cost for 1 Hash: 1 / (6MHash/s/$ * 1yr) = 5.3-15$
  • Total cost for 1 Hash: 2 * 10-14$
  • Hashes for 1 Dollar: 5*1013
  • Hashes for 1'000'000 Dollars: 5*1019

This corresponds to a 65 bit password, protected with plain SHA256. TrueCrypt uses PBKDF2 with 1000 iterations, which gives us a factor 2000 bonus, so we can subtract 11 bits, and we arrive at 54 bits.

Conclusion

An attacker willing to spend one million, can crack TrueCrypt passwords up to 54 bits of entropy. Estimate the value of your secrets, and adjust it appropriately.

A sophisticated attacker might use custom hardware, which would make the attack even cheaper. But I don't have any numbers at hand, how much energy custom hardware requires per hash.

A completely random password of length 15 chosen from 37 different characters has an entropy of 78 bits, and thus is safely out of range for graphics card based attacks. Note that this only applies if the password is completely random. If it has some exploitable structure, such as words or keyboard patterns, the entropy might be considerably lower.

1 PBKDF2 uses 1HMac per iterations, which in turn has 2 hash invocations

2 I base this on Bitcoin Mining hardware comparison using that one bitcoin hash consists of 2 SHA256 invocations.

A quick calculation:

First my assumptions:

I assume the attacker has 1'000'000$ to spend over the course of two years. He's using standard graphics cards, and pays 10ct/kWh.

I assume that the KDF consists of 2*n SHA256 invocations, where n is the iteration count, and can be implemented with similar efficiency on graphics cards as plain SHA256. 1

A current graphics card gives around 6MHash/s/$ and around 4MHash/J. 2

Calculation

  • Electricity cost for 1 Hash: ($0.10/kWh) / (4MHash/J) = 7*10-15$
  • Hardware cost for 1 Hash: 1 / (6MHash/s/$ * 1yr) = 5-15$
  • Total cost for 1 Hash: 1.2 * 10-14$
  • Hashes for 1 Dollar: 8*1013
  • Hashes for 1'000'000 Dollars: 8*1019

This corresponds to a 66 bit password, protected with plain SHA256. TrueCrypt uses PBKDF2 with 1000 iterations, which gives us a factor 2000 bonus, so we can subtract 11 bits, and we arrive at 55 bits.

Conclusion

An attacker willing to spend one million, can crack TrueCrypt passwords up to 55 bits of entropy. Estimate the value of your secrets, and adjust it appropriately.

A sophisticated attacker might use custom hardware, which would make the attack even cheaper. But I don't have any numbers at hand, how much energy custom hardware requires per hash.

A completely random password of length 15 chosen from 37 different characters has an entropy of 78 bits, and thus is safely out of range for graphics card based attacks. Note that this only applies if the password is completely random. If it has some exploitable structure, such as words or keyboard patterns, the entropy might be considerably lower.

1 PBKDF2 uses 1HMac per iterations, which in turn has 2 hash invocations

2 I base this on Bitcoin Mining hardware comparison using that one bitcoin hash consists of 2 SHA256 invocations.

Source Link
CodesInChaos
CodesInChaos
  • 12.1k
  • 2
  • 42
  • 50

A quick calculation:

First my assumptions:

I assume the attacker has 1'000'000$ to spend over the course of two years. He's using standard graphics cards, and pays 10ct/kWh.

I assume that the KDF consists of 2*n SHA256 invocations, where n is the iteration count, and can be implemented with similar efficiency on graphics cards as plain SHA256. 1

A current graphics card gives around 6MHash/s/$ and around 2MHash/J. 2

Calculation

  • Electricity cost for 1 Hash: ($0.10/kWh) / (2MHash/J) = 1.4*10-14$
  • Hardware cost for 1 Hash: 1 / (6MHash/s/$ * 1yr) = 5.3-15$
  • Total cost for 1 Hash: 2 * 10-14$
  • Hashes for 1 Dollar: 5*1013
  • Hashes for 1'000'000 Dollars: 5*1019

This corresponds to a 65 bit password, protected with plain SHA256. TrueCrypt uses PBKDF2 with 1000 iterations, which gives us a factor 2000 bonus, so we can subtract 11 bits, and we arrive at 54 bits.

Conclusion

An attacker willing to spend one million, can crack TrueCrypt passwords up to 54 bits of entropy. Estimate the value of your secrets, and adjust it appropriately.

A sophisticated attacker might use custom hardware, which would make the attack even cheaper. But I don't have any numbers at hand, how much energy custom hardware requires per hash.

A completely random password of length 15 chosen from 37 different characters has an entropy of 78 bits, and thus is safely out of range for graphics card based attacks. Note that this only applies if the password is completely random. If it has some exploitable structure, such as words or keyboard patterns, the entropy might be considerably lower.

1 PBKDF2 uses 1HMac per iterations, which in turn has 2 hash invocations

2 I base this on Bitcoin Mining hardware comparison using that one bitcoin hash consists of 2 SHA256 invocations.